An ISO 27001 gap analysis maps what you already do against the 93 Annex A controls in ISO 27001:2022, before an auditor finds the gaps for you at Stage 1. Run it properly in 2026 and certification stops being a scramble and starts being a checklist.
Why this matters
A failed Stage 1 audit costs money twice: the original audit fee and a re-visit fee once you've fixed the gaps. Certification bodies don't discount repeat visits.
ISO 27001:2022 restructured Annex A into four themes — organisational, people, physical, technological — down from the old 14-domain structure. A lot of businesses in 2026 are still running gap analyses off the 2013 checklist, which mismatches what a Stage 1 auditor is actually scoring against.
This matters more for SaaS companies. ISO 27001 for SaaS startups covers why the framework fits software businesses specifically, but the gap analysis mechanics below apply whatever you sell.
What you'll need
- The current ISO 27001:2022 Annex A control list, all 93 controls across the four themes
- A draft or template Statement of Applicability (SoA)
- Existing policies: access control, incident response, asset register, supplier management
- 2-4 weeks of calendar time, plus access to your IT lead, HR, and operations owners
- A scoring method: Fully Implemented, Partially Implemented, Not Implemented, Not Applicable
- A tracker — a spreadsheet works, but a compliance platform speeds this up considerably
The steps
1. Define your certification scope
Decide which business units, offices, systems, and data flows sit inside the ISO 27001 boundary. This accomplishes one thing: it stops the gap analysis expanding to cover things the auditor will never look at.
Write the scope statement in one paragraph. If you run a single product on AWS with 20 staff, your scope might be "the production environment and supporting business processes for [product], excluding marketing website infrastructure."
Common mistake: scoping the whole company when only one product needs certification, which triples the control set you have to gap-check.
2. Pull the Annex A control list and build your tracker
List all 93 controls in a spreadsheet or platform, one row each, grouped by the four 2022 themes. This becomes your master tracking document for the rest of the process.
Add columns for: current status, evidence location, control owner, target date, and auditor notes. OneClickComply builds this mapping automatically against Annex A, which removes a full day of manual spreadsheet setup.
Expected outcome: a single source of truth that every control owner can see and update.
3. Interview control owners and score each control
Sit down with whoever owns each area — IT, HR, facilities, ops — and score every control against your four-point scale. This is the step that actually produces the gap analysis; everything before it is setup.
Budget 30-45 minutes per department, not per control. Most departments own 15-20 controls, so a focused interview covers them all in one sitting.
Common mistake: scoring controls based on policy documents alone rather than what actually happens day to day. Auditors ask for evidence, not intentions.
4. Document evidence gaps control-by-control
For every control scored below Fully Implemented, write down exactly what's missing: a policy, a log, a signed record, a configuration setting. Vague notes like "needs work" don't help whoever fixes it in three weeks.
Specific example: if your access review control is Partially Implemented, note "quarterly access reviews happen but aren't documented — need a signed sign-off template and a Q1 2026 review record."
Expected outcome: a remediation backlog specific enough that someone else could pick it up and act on it.
5. Prioritise gaps by risk and audit weighting
Not all 93 controls carry equal audit weight. Access control, incident response, and asset management get the most auditor attention because they're the controls most likely to fail in a breach.
Sort your gap list into three tiers: fix before Stage 1, fix before Stage 2, fix within the first surveillance cycle. Aim to close every Tier 1 gap — typically 8-12 controls — before you book anything with a certification body.
Common mistake: treating all 15-25 gaps as equal urgency, which spreads remediation effort too thin to close the ones that actually block certification.
6. Build a remediation plan with owners and dates
Assign every gap a named owner and a real date, not "Q1." A gap analysis without a remediation plan is just a longer way of saying "we have problems."
A realistic Tier 1 remediation plan for a 20-person SaaS company runs 4-6 weeks. Larger, more distributed businesses need 8-12 weeks for Tier 1 alone.
Expected outcome: a project plan you can hand to a certification body or an internal stakeholder and have them trust the timeline.
7. Draft your Statement of Applicability
The SoA lists all 93 controls, whether each applies to your scope, and why. This is the document a Stage 1 auditor reads first, so it needs to match your gap analysis exactly.
Every "Not Applicable" needs a one-line justification. "We don't process card payments" is a valid reason to mark PCI-adjacent controls as excluded; "we haven't gotten to it" is not.
Common mistake: an SoA drafted before the gap analysis finishes, so it contradicts the tracker by the time the auditor cross-references both.
8. Re-score before booking Stage 1
Run the scoring pass again after remediation closes your Tier 1 gaps. This confirms the fixes actually landed rather than existing as a plan on paper.
Only book your Stage 1 audit once every Tier 1 control scores Fully Implemented and Tier 2 has a documented closure date. Certification bodies in 2026 are increasingly checking SoA-to-evidence consistency before they even schedule a visit.
Expected outcome: a Stage 1 audit that surfaces zero surprises, because you already found them yourself.
Automate your ISO 27001 gap analysis
Map Annex A controls, track evidence, and prep for Stage 1 in one place.
Troubleshooting
Control owners don't know who owns what. Assign ownership by department function, not by job title. Whoever manages laptops owns asset management; whoever runs onboarding owns access control, even if neither has "security" in their title.
Evidence exists but isn't centralised. Screenshots in Slack threads and policies in three different Google Drives don't count as auditable evidence. How to automate evidence collection for audits covers how to pull this into one system before Stage 1.
Scope keeps expanding mid-analysis. Lock the scope statement in writing before step 2 and refuse changes without a documented reason. Scope creep is the single biggest reason gap analyses run past the 2-4 week target.
Gap count seems too high to fix before your audit date. Push the audit date back. A Stage 1 audit against 20 unresolved Tier 1 gaps fails and costs a re-audit fee; a delayed booking costs nothing but time.
Statement of Applicability doesn't match gap analysis findings. Rebuild the SoA from the tracker directly, control by control, rather than editing an old template. Mismatches here are the most common reason auditors send an SoA back for revision.
Tools and resources
- A spreadsheet tracker with the 93 Annex A controls, or OneClickComply's ISO 27001 compliance software for lean teams that don't have a dedicated compliance hire
- Your existing policy library: access control, incident response, asset register, supplier agreements
- A control-owner interview schedule, one session per department
- A remediation tracker with named owners and real dates, not quarters
What to do next
Once your gap analysis is closed and Stage 1 is booked, the work doesn't stop. How to pass an ISO 27001 surveillance audit covers what happens in year two and three, when auditors check whether your controls held up rather than whether they existed on day one.
Frequently asked questions
One last thing
The most-missed control in first-pass gap analyses isn't technical — it's supplier management. Businesses fix access control and encryption fast because those feel like "security," then leave vendor risk assessments undocumented because it feels like paperwork. Auditors weight it the same as anything else in 2026, and it's usually the last gap standing between a tracker full of green ticks and a booked Stage 1 date.